Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

JaffaCakes...30.exe

windows7-x64

10

JaffaCakes...30.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    135s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2024, 14:27 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe

  • Size

    203KB

  • MD5

    9548b98a2c042b1d5cf452c944741e4b

  • SHA1

    4af8f04e0fb68a5dc2d0c36863118327b12e9176

  • SHA256

    79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230

  • SHA512

    bbca99d3c50ac3f3c207647fb994eafe8a473804da786853f879e34cf55d7a8cad05c81e05b816bf4966f02491fc6f666b123821fdc15f4ce2e46138d4be470c

  • SSDEEP

    6144:MLV6Bta6dtJmakIM5biROdyAr/GpBPLciDbk:MLV6BtpmkccC/OLHDbk

Score
10/10
nanocorediscoveryevasionkeyloggerpersistencespywarestealertrojan

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Nanocore family
    nanocore
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in Program Files directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe"
    1⤵
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:536
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "DHCP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB66F.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2132
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "DHCP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB6CE.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:956

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    chinomso.duckdns.org
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    Remote address:
    8.8.8.8:53
    Request
    chinomso.duckdns.org
    IN A
    Response
    chinomso.duckdns.org
    IN A
    38.170.239.46
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    4.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    4.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    chinomso.duckdns.org
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    Remote address:
    8.8.8.8:53
    Request
    chinomso.duckdns.org
    IN A
    Response
    chinomso.duckdns.org
    IN A
    38.170.239.46
  • flag-us
    DNS
    chinomso.duckdns.org
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    Remote address:
    8.8.8.8:53
    Request
    chinomso.duckdns.org
    IN A
  • flag-us
    DNS
    197.87.175.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    197.87.175.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    chinomso.duckdns.org
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    Remote address:
    8.8.8.8:53
    Request
    chinomso.duckdns.org
    IN A
    Response
    chinomso.duckdns.org
    IN A
    38.170.239.46
  • flag-us
    DNS
    chinomso.duckdns.org
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    Remote address:
    8.8.8.8:53
    Request
    chinomso.duckdns.org
    IN A
    Response
    chinomso.duckdns.org
    IN A
    38.170.239.46
  • flag-us
    DNS
    chinomso.duckdns.org
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    Remote address:
    8.8.8.8:53
    Request
    chinomso.duckdns.org
    IN A
    Response
    chinomso.duckdns.org
    IN A
    38.170.239.46
  • flag-us
    DNS
    chinomso.duckdns.org
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    Remote address:
    8.8.8.8:53
    Request
    chinomso.duckdns.org
    IN A
    Response
    chinomso.duckdns.org
    IN A
    38.170.239.46
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    23.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.236.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    chinomso.duckdns.org
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    Remote address:
    8.8.8.8:53
    Request
    chinomso.duckdns.org
    IN A
    Response
    chinomso.duckdns.org
    IN A
    38.170.239.46
  • flag-us
    DNS
    chinomso.duckdns.org
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    Remote address:
    8.8.8.8:53
    Request
    chinomso.duckdns.org
    IN A
    Response
    chinomso.duckdns.org
    IN A
    38.170.239.46
  • flag-us
    DNS
    chinomso.duckdns.org
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    Remote address:
    8.8.8.8:53
    Request
    chinomso.duckdns.org
    IN A
    Response
    chinomso.duckdns.org
    IN A
    38.170.239.46
  • 38.170.239.46:7688
    chinomso.duckdns.org
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    208 B
     4
  • 38.170.239.46:7688
    chinomso.duckdns.org
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    208 B
     4
  • 38.170.239.46:7688
    chinomso.duckdns.org
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    208 B
     4
  • 38.170.239.46:7688
    chinomso.duckdns.org
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    208 B
     4
  • 38.170.239.46:7688
    chinomso.duckdns.org
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    208 B
     4
  • 38.170.239.46:7688
    chinomso.duckdns.org
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    208 B
     4
  • 38.170.239.46:7688
    chinomso.duckdns.org
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    208 B
     4
  • 38.170.239.46:7688
    chinomso.duckdns.org
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    208 B
     4
  • 38.170.239.46:7688
    chinomso.duckdns.org
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    208 B
     4
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    chinomso.duckdns.org
    dns
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    66 B
     82 B
     1
    1

    DNS Request

    chinomso.duckdns.org

    DNS Response

    38.170.239.46

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    4.159.190.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    4.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    chinomso.duckdns.org
    dns
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    132 B
     82 B
     2
    1

    DNS Request

    chinomso.duckdns.org

    DNS Request

    chinomso.duckdns.org

    DNS Response

    38.170.239.46

  • 8.8.8.8:53
    197.87.175.4.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    197.87.175.4.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    chinomso.duckdns.org
    dns
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    66 B
     82 B
     1
    1

    DNS Request

    chinomso.duckdns.org

    DNS Response

    38.170.239.46

  • 8.8.8.8:53
    chinomso.duckdns.org
    dns
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    66 B
     82 B
     1
    1

    DNS Request

    chinomso.duckdns.org

    DNS Response

    38.170.239.46

  • 8.8.8.8:53
    chinomso.duckdns.org
    dns
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    66 B
     82 B
     1
    1

    DNS Request

    chinomso.duckdns.org

    DNS Response

    38.170.239.46

  • 8.8.8.8:53
    chinomso.duckdns.org
    dns
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    66 B
     82 B
     1
    1

    DNS Request

    chinomso.duckdns.org

    DNS Response

    38.170.239.46

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    23.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    23.236.111.52.in-addr.arpa

  • 8.8.8.8:53
    chinomso.duckdns.org
    dns
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    66 B
     82 B
     1
    1

    DNS Request

    chinomso.duckdns.org

    DNS Response

    38.170.239.46

  • 8.8.8.8:53
    chinomso.duckdns.org
    dns
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    66 B
     82 B
     1
    1

    DNS Request

    chinomso.duckdns.org

    DNS Response

    38.170.239.46

  • 8.8.8.8:53
    chinomso.duckdns.org
    dns
    JaffaCakes118_79b6d119c6ba10a1b18516bb59c8439ac4a59c4e01637af7a06f8852a135a230.exe
    66 B
     82 B
     1
    1

    DNS Request

    chinomso.duckdns.org

    DNS Response

    38.170.239.46

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpB66F.tmp
    Filesize

    1KB

    MD5

    0c6dce91d20e4099b4c298d3bb2355ea

    SHA1

    47d30b97667c4cbe3c0055e5c0db3db9cbb157ab

    SHA256

    0ffc29f759f9b60f911070672a14753a88b7e013079d66d9d8c4aa4ebc933d78

    SHA512

    b774cabdc0218a715aeeb12adde7ccf4ed8a3f93414262b396326b02d4a74c14d10ddb3926edc158d6e415c8a312724f66e85659d2547f6db9895550b1a72cfb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmpB6CE.tmp
    Filesize

    1KB

    MD5

    0479d5f304ef2d7e3c15fb24a99f88c1

    SHA1

    8edbb1450a656fac5f5e96779ffe440ee8c1aec9

    SHA256

    112557c2b2d0c669a3b115129dc32f005341e965330fa8f2ad3e5de1926594bc

    SHA512

    537e8d87e5cd975f0e69bb145f81d6e9d7b0d82eed143ac351304ea38577137386a51fdb7357ec6d641eb04ff5f51e249bba2db8a4b5bf2934d561394a4a3f15

    Download Submit

  • memory/536-0-0x00000000749B2000-0x00000000749B3000-memory.dmp

    Filesize

    4KB

    Download

  • memory/536-1-0x00000000749B0000-0x0000000074F61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/536-2-0x00000000749B0000-0x0000000074F61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/536-10-0x00000000749B0000-0x0000000074F61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/536-11-0x00000000749B2000-0x00000000749B3000-memory.dmp

    Filesize

    4KB

    Download

  • memory/536-12-0x00000000749B0000-0x0000000074F61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/536-13-0x00000000749B0000-0x0000000074F61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/536-14-0x00000000749B0000-0x0000000074F61000-memory.dmp

    Filesize

    5.7MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.